# Markdown image exfiltration in LLM apps

Model output or ingested content rendered as markdown/HTML that auto-fetches attacker URLs, carrying secrets

_Area: AI and LLM app security. Seen in 24 disclosed reports; 2 confirmed bounties: $20,000 and $50,000; latest 2026-05-04. Updated 2026-10-23._

## How it works
An LLM app treats model output and ingested content as trusted display material. When that text is rendered as markdown or HTML, resource-loading primitives (image tags, CSS backgrounds, `@font-face` fonts, diagram image nodes) make the browser fetch attacker-chosen URLs automatically, with no user click. If injected instructions can also read secrets (chat history, Gmail, `.env`, environment tokens), they place those secrets in the URL path or query string, and the fetch itself is the exfiltration. The broken assumption: that rendered output is inert, and that a CSP, sanitizer, or model refusal makes the fetch safe.

## Where it shows up
- Chat/agent UIs that auto-render markdown images or HTML previews from model output or untrusted content (docs, web pages, code comments, tool output) [E1](https://bugbountylibrary.com/r/blog%3Alandh-tech-blog-20240304-google-hack-50000.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-openhands-the-lethal-trifecta-strikes-again.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-can-leak-your-secrets.md)[E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cline-vulnerable-to-data-exfiltration.md)[E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-data-exfiltration-via-images.md)
- CSP allowlists with wildcard user-hosting domains (`*.googleusercontent.com`, `*.google.com`) or permissive `img-src`/`font-src` [E1](https://bugbountylibrary.com/r/blog%3Alandh-tech-blog-20240304-google-hack-50000.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-defcon-talk-copirate-365.md)
- Allowed open redirects (e.g. `/amp/`) that launder an attacker host through an allowlisted domain [E1](https://bugbountylibrary.com/r/blog%3Alandh-tech-blog-20240304-google-hack-50000.md)
- Sanitizer running before a linkifier/renderer, or export paths that escape `![](...)` but not hyperlink URIs [E8](https://bugbountylibrary.com/r/blog%3Abuganizer-cc-hacking-gemini-a-multi-layered-approach-md.md)
- Diagram renderers (Mermaid) that load external image URLs without sandboxing or confirmation [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cursor-data-exfiltration-with-mermaid.md)
- Agents with shell/browser tools and default internet egress, or auto-opening preview panes, no domain allowlist or approval [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-defcon-talk-copirate-365.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-can-leak-your-secrets.md)

## How to review
Separate two sink classes. Auto-render sinks: does rendering fetch anything automatically, and is the CSP/allowlist limited to first-party, non-user-deployable hosts? Fetch-tool sinks: can the model open previews or call fetch tools without human approval, and is egress sandboxed? The invariant: no outbound request may be triggered by model output or ingested content to a destination not on a strict allowlist, and no secret may appear in a URL the client fetches. Also check whether a sanitized link can be flipped into an image by a character the linkifier ignores [E8](https://bugbountylibrary.com/r/blog%3Abuganizer-cc-hacking-gemini-a-multi-layered-approach-md.md).

## Variants seen
- Markdown image in chat output plus CSP bypass via open redirect [E1](https://bugbountylibrary.com/r/blog%3Alandh-tech-blog-20240304-google-hack-50000.md)
- HTML preview with font-src/img-src bypass and model-induced auto-open [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-defcon-talk-copirate-365.md)
- Agent renders markdown images from untrusted content, leaking environment token [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-openhands-the-lethal-trifecta-strikes-again.md)
- Agent with shell/browser tools and markdown rendering leaks env vars [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-can-leak-your-secrets.md)
- Mermaid diagram external image URLs as exfil channel [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cursor-data-exfiltration-with-mermaid.md)
- Coding agent auto-renders images, smuggling `.env` secrets [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cline-vulnerable-to-data-exfiltration.md)[E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-data-exfiltration-via-images.md)
- Sanitizer/linkifier ordering bug turning links into images [E8](https://bugbountylibrary.com/r/blog%3Abuganizer-cc-hacking-gemini-a-multi-layered-approach-md.md)

## Why fixes fail
Model refusals and secret-redaction filters are bypassable with subpattern matching and encoding; the real control is blocking outbound image loads rather than trusting the LLM [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-openhands-the-lethal-trifecta-strikes-again.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-can-leak-your-secrets.md).

## Impact and severity
Exfiltration of Gmail PII, Workspace data, chat history, and `.env` secrets; bounties up to $50,000 [E1](https://bugbountylibrary.com/r/blog%3Alandh-tech-blog-20240304-google-hack-50000.md). Worse when secrets are broad, CSP is permissive, and no human approval gates the fetch [E1](https://bugbountylibrary.com/r/blog%3Alandh-tech-blog-20240304-google-hack-50000.md)[E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-defcon-talk-copirate-365.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-openhands-the-lethal-trifecta-strikes-again.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Alandh-tech-blog-20240304-google-hack-50000.md
- E2: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-defcon-talk-copirate-365.md
- E3: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-openhands-the-lethal-trifecta-strikes-again.md
- E4: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-devin-can-leak-your-secrets.md
- E5: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cursor-data-exfiltration-with-mermaid.md
- E6: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-cline-vulnerable-to-data-exfiltration.md
- E7: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-amp-code-fixed-data-exfiltration-via-images.md
- E8: https://bugbountylibrary.com/r/blog%3Abuganizer-cc-hacking-gemini-a-multi-layered-approach-md.md